CVE Feed

    Dashboard / CVE / CVE-2021-24444

    CVE-2021-24444

    The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.

    Published:Aug 2, 2021
    Last Modified:Nov 21, 2024
    EPS:Aug 2, 2021
    EPSS Score:0.03592
    CVSS Score:4.8

    Affected Products

    Vendor
    Taxopress
    Product
    Taxopress

    Exploits

    https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8bhttps://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8bhttps://www.exploit-db.com/exploits/50442

    Related CVEs

    CVE-2025-14371 (CVSS 4.3) — The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unau…
    CVE-2025-13359 (CVSS 6.5) — The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time…
    CVE-2025-13354 (CVSS 4.3) — The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to auth…
    CVE-2025-55710 (CVSS 4.3) — Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress simple-tags allows Re…
    CVE-2025-0627 (CVSS 3.5) — The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape…
    CVE-2024-43237 (CVSS 5.3) — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Steve Burge WordPress Tag Cloud Pl…
    CVE-2023-2170 (CVSS 5.5) — The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts function…
    CVE-2023-2169 (CVSS 5.5) — The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts function…
    CVE-2023-2168 (CVSS 5.5) — The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title fi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High